An issue was discovered in urllib3 before 1.26.5.
Priority LOW 39CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 9 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
Why it matters now
EPSS 0.03273 88th percentileScored 2026-11-07
Fix Partial urllib3 (PyPI): 1.26.5Red Hat: 5 advisoriesRed Hat: 9 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | urllib3 (PyPI) | 1.25.4 to before 1.26.5 | 1.26.5 | Patch available | GHSA-q2q7-5pp4-w6pg |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- urllib3 (PyPI) Vendor— Affected 1.25.4 to before 1.26.5 Fixed in 1.26.5 Patch available GHSA-q2q7-5pp4-w6pg
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* | 1.25.4 to before 1.26.5 | Vulnerable | python-pillow |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* | 12.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* | 17.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* | 17.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* | 17.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
- cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 1.25.4 to before 1.26.5 Vulnerable ·python-pillow
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* Versions 12.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
Remediation
- Fix · GHSA-q2q7-5pp4-w6pg urllib3 (PyPI) Fixed in 1.26.5 Advisory →
Red Hat 5 advisories
- RHSA-2021:4702 Released 2021-11-16 · Red Hat rating ModerateSatellite 6.10 Release
- Red Hat Satellite 6.10 candlepin-4.0.9-1.el7sat, foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc +14
- Red Hat Satellite Capsule 6.10 foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc, python-ecdsa-0.13.3-2.el7pc +9
- RHSA-2021:4160 Released 2021-11-09 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat CodeReady Linux Builder (v. 8) Cython-0.29.21-5.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pybind11-2.6.1-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9 +33
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
- RHSA-2021:4162 Released 2021-11-09 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat CodeReady Linux Builder (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
Show 2 more Red Hat advisories
- RHSA-2021:3473 Released 2021-09-08 · Red Hat rating ModerateRed Hat Automation Platform 1.2.5 security and bugfixes update
- Red Hat Automation Hub 4.2 for RHEL 7 automation-hub-4.2.6-1.el7pc, python-galaxy-ng-4.2.6-1.el7pc, python-urllib3-1.26.5-1.el7pc +8
- Red Hat Automation Hub 4.2 for RHEL 8 automation-hub-4.2.6-1.el8pc, python-galaxy-ng-4.2.6-1.el8pc, python-urllib3-1.26.5-1.el8pc +7
- RHSA-2021:3254 Released 2021-08-24 · Red Hat rating Moderaterh-python38 security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Automation Hub 4.2 for RHEL 7 | Fixed | RHSA-2021:3473 |
| Red Hat Automation Hub 4.2 for RHEL 8 | Fixed | RHSA-2021:3473 |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2021:4160, RHSA-2021:4162 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4160, RHSA-2021:4162 |
| Red Hat Satellite 6.10 | Fixed | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6.10 | Fixed | RHSA-2021:4702 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3254 |
Not affected: 11 products
- Red Hat Automation Hub 4.2 for RHEL 7
- Red Hat Automation Hub 4.2 for RHEL 8
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat Satellite 6.10
- Red Hat Satellite Capsule 6.10
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33503
- 2026-10-03 Alias added: GHSA-q2q7-5pp4-w6pg
References
Patch 2
Advisory 5
Other 6
- https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg
- https://github.com/urllib3/urllib3/commit/5b047b645f5f93900d5e2fc31230848c25eb1f5f#diff-52026d639119bf1e0364836b4e8a18bd9ed3c95c6ba39b26534a5057a65e35bbR65
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-108.yaml
- https://github.com/urllib3/urllib3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6SCV7ZNAHS3E6PBFLJGENCDRDRWRZZ6W
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FMUGWEAUYGGHTPPXT6YBD53WYXQGVV73
Sources
- CVE-2021-33503 · CVE Program
- CVE-2021-33503 · NVD
- FIRST EPSS
- GHSA-q2q7-5pp4-w6pg · GitHub Advisory Database · CC BY 4.0
- CVE-2021-33503 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences